It's become very obvious that recent updates hit sites that had overly aggressive link profiles. The types of sites that were almost exclusively within what I called the "danger zone" in a post about one month before Penguin hit. Highly unnatural anchor text and low-quality links are highly correlated, but anchor text appears to have been the focus.

1. Cleansing Domains

While not technically a form of link building, 301 "cleansing" domains are a dynamic of link manipulation that every SEO should understand. When you play the black hat game, you know the chance of getting burned is very real. Building links to a domain that redirects to a main domain is one traditionally safe way to quickly recover from Google actions like Penguin. While everyone else toils away attempting to remove scores of exact-match anchor text, the spammers just cut the trouble redirected domains loose like anchors, and float on into the night with whatever treasure they've gathered.
Link building through redirects should be easy to catch, as new links to a domain that is currently redirecting is hardly natural behavior. To anyone watching, it's like shooting up a flare that says, "I'm probably manipulating links." The fact that search engines aren't watching closely right now is no guarantee of future success, so I'd avoid this and similar behavior if future success is a goal.

2. Blog Networks & Poorly Executed Guest Blogs

I've already covered the potential risks of blog networks in depth here. Google hates blog networks - fake blogs that members pay or contribute content to in order to get links back to their or their clients' sites. Guest blogging and other forms of contributing content to legitimate sites is a much whiter tactic, but consider that a strategy that relies heavily on low-quality guest blogging looks a lot like blog network spam.
With blog networks, each blog has content with a constant ratio of words to links. It posts externally to a random sites multiple times, and with a lot of "inorganic" anchor text for commercially valuable terms. Almost all backlinks to blog networks are also spam.
I cringe when I see low-quality blogs with questionable backlinks accepting guest blog posts that meet rigid word length and external link guidelines. Quality blogs tend not to care if the post is 400-500 words with two links in the bio, and quality writers tend not to ruin the post with excessive linking. Most of us see guest blogging as a white-hat tactic, but a backlink profile filled with low-quality guest posts looks remarkably similar to the profile of a site using automated blog networks.
I'd obviously steer clear of blog networks, but I'd be just as wary of low-quality inorganic guest blogs that look unnatural. Guest blog on sites with high quality standards and legitimate backlink profiles of their own.

3. Article Marketing Spam

Article link addiction is still a real thing for new SEOs. You get one or two links with anchor text of your choice, and your rankings rise. You're not on the first page, but you do it again and get closer. The articles are easy and cheap, and they take no creativity or mental effort. You realize that you're reaching diminishing returns on the articles, but your solution isn't to stop - you just need to do more articles. Before you know it, you're searching for lists of the top article sites that give followed links and looking for automated solutions to build low-quality links to your low-quality links.
Most articles are made for the sole purpose of getting a link, and essentially all followed links are self-generated rather than endorsements. Google has accordingly made article links count for very little, and has hammered article sites for their low-quality content.
Maybe you're wondering how to get a piece of that awesome trend, but hopefully you'll join me in accepting that article directories aren't coming back. Because they can theoretically be legitimate, article links are generally devalued rather than penalized. As with all link spam, your risk of receiving more harsh punishment rises proportionate to the percentage of similar links in your profile.

4. Single-Post Blogs

Ironically named "Web 2.0 Blogs" by some spam peddlers, these two-page blogs on Tumblr and Wordpress sub-domains never see the light of day. After setting up the free content hub with an article or two, the site is then "infused" with link juice, generally from social bookmarking links (discussed below).
Despite their prevalence, these sites don't do much for rankings. Links with no weight come in, and links with no impact go out. They persist because with a decent free template, clients can be shown a link on a page that doesn't look bad. Google doesn't need to do much to weed these out, because they're already doing nothing.

5. (Paid) Site-Wide Links

Site-wide footer links used to be all the rage. Google crippled their link-juice-passing power because most footer links pointing to external sites are either Google Bombs or paid links. Where else would you put a site-wide link that you don't want your users to click?
To my point of avoiding the appearance of spam, Penguin slammed a number of sites with a high proportion of site-wide (footer) links that many would not have considered manipulative. Almost every free Wordpress theme that I've seen links back to the creator's page with choice anchor text, and now a lot of Wordpress themes are desperately pushing updates to alter or remove the link. Penguin didn't care if you got crazy with a plugin link, designed a web site, or hacked a template; the over-use of anchor text hit everyone. This goes to show that widespread industry practices aren't inherently safe.

6. Paid Links in Content

There will never be a foolproof way to detect every paid link. That said it's easier than you think to leave a footprint when you do it in bulk. You have to trust your sellers not to make it obvious, and the other buyers to keep unwanted attention off their own sites. If one buyer that you have no relationship to buys links recklessly, the scrutiny can trickle down through the sites they're buying from and eventually back to you.
If you do buy links, knowing what you're doing isn't enough. Make sure everyone involved knows what they're doing. Google is not forgiving when it comes to buying links.

7. Link Exchanges, Wheels, etc.

Speaking of footprints, I believe it's possible to build a machine learning model to start with a profile of known links violating guidelines, which you can acquire from paid link sites and link wheel middlemen with nothing more than an email address. You can then assess a probability of a site being linked to in that manner, corroborating potential buyers and sellers with a link graph of similar profiles. I have no idea what kind of computing/programming power this would take, but the footprint is anomalous enough that it should be possible.
Exchanging links through link schemes requires a lot more faith in a bunch of strangers than I can muster. In a link wheel, you're only as strong and subtle as your "weakest links." My opinion is that if you're smart enough to avoid getting caught, you're probably smart enough to build or write something awesome that will have superior results and lower risk than link wheels.

8. Low-Quality Press Release Syndication

High-quality syndication and wire services possess a few unattractive attributes for spammers: there are editorial guidelines, costs, and even fact checking. Low-quality syndication services will send almost anything through to any site that will take it. You'll end up with a bunch of links, but not many that get indexed, and even fewer that get counted.
My experience has been that press releases have rapidly diminishing returns on syndication only, and the only way to see ROI is to generate actual, real coverage. I still see link-packed press releases all over the web that don't have a chance of getting coverage - really, your site redesign is not news-worthy. I'm not sure whether to attribute this to bad PR, bad SEO, or both.

9. Linkbait and Switch

In this context, we're talking about creating a real piece of linkbait for credible links, and later replacing the content with something more financially beneficial. Tricking people into linking to content is clearly not something Google would be ok with. I don't see linkbait and switch done very often, but I die a little every time I see it. If you're able to create and spread viral content, there's no need to risk upsetting link partners and search engines. Instead, make the best of it with smart links on the viral URL, repeat success, and become a known source for great content.

10. Directories

Directories have been discussed to death. The summary is that Google wants to devalue links from directories with no true standards. Here's a Matt Cutts video and blog post on the topic. Directory links often suffer from a high out/in linking ratio, but those worth getting are those that are actually used for local businesses (think Yelp) and any trafficked industry directories.

1. 
   Would I pay money for a listing here?
2. 
   Are the majority of current listings quality sites?
3. 
   Do listings link with the business or site name?

If the answer to any of these questions is no, don't bother with a link. This immediately excludes all but a handful of RSS or blog feed directories, which are mostly used to report higher quantities of links. When I was trained as an SEO, I was taught that directories would never hurt, but they might help a tiny bit, so I should go get thousands of them in the cheapest way possible. Recent experience has taught us that poor directory links can be a liability.
Even as I was in the process of writing this post, it appears that Google began deindexing low-quality directories. The effect seems small so far - perhaps testifying to their minimal impact on improving rankings in the first place - but we'll have to wait and see.

11. Link Farms and Networks

I honestly can't speak as an authority on link farms, having never used them personally or seen them in action.
My sense is that this prediction came true over and over again. I'd love to hear your thoughts.

12. Social Bookmarking & Sharing Sites

Links from the majority of social bookmarking sites carry no value. Pointing a dozen of them at a page might not even be enough to get the page crawled. Any quality links that go in have their equity immediately torn a million different directions if links are followed. The prevalence of spam-filled and abandoned social bookmarking sites tells me that site builders seriously over-estimated how much we would care about other people's bookmarks.
Sites focusing on user-generated links and content have their own ways of handling trash. Active sites with good spam control and user involvement will filter spam on their own while placing the best content prominently. If you'd like to test this, just submit a commercial link to any front-page sub-Reddit and time how long it takes to get the link banned. Social sites with low spam control stop getting visitors and incoming links while being overrun by low quality external links. Just ask Digg.

13. Forum Spam

Forum spam may never die, though it is already dead. About a year ago, we faced a question about a forum signature link that was in literally thousands of posts on a popular online forum. When we removed the signature links, the change was similar to effect of most forum links: zero. It doesn't even matter if you nofollow all links. Much like social sites, forums that can't manage the spam quickly turn into a cesspool of garbled phrases and anchor text links. Bing's webmaster forums are a depressing example.

14. Unintended Followed Link Spam

From time to time you'll hear of a new way someone found to get a link on an authoritative site. Examples I have seen include links in bios, "workout journals" that the site let users keep, wish lists, and uploaded files. Sometimes these exploits (for lack of a better term) go viral, and everyone can't wait to fill out their bio on a DA 90+ site.
In rare instances, this kind of link spam works - until the hole is plugged. I can't help but shake my head when I see someone talking about how you can upload a random file or fill out a bio somewhere. This isn't the sort of thing to base your SEO strategy around. It's not long-term, and it's not high-impact.

15. Profile Spam

While similar to unintended followed links on authority domains, profile spam deserves its own discussion due to their abundance. It would be difficult for Google to take any harsh action on profiles, as there is a legitimate reason for reserving massive numbers of profiles to prevent squatters and imitators from using a brand name.
What will hurt you is when your profile name and/or anchor text doesn't match your site or brand name.
When profile links are followed and indexed, Google usually interprets the page as a user page and values it accordingly. Obviously Google's system for devaluing profile links is not perfect right now. I know it's sometimes satisfying just to get an easy link somewhere, but profile link spam is a great example of running without moving.

16. Comment Spam

If I were an engineer on a team designed to combat web spam, the very first thing I would do would be to add a classifier to blog comments. I would then devalue every last one. Only then would I create exceptions where blog comments would count for anything.
I have no idea if it works that way, but it probably doesn't. I do know that blogs with unfiltered followed links are generally old and unread, and they often look like this:
Let's pretend that Google counts every link equally, regardless of where it is on the page. How much do you think 1/1809th of the link juice on a low-authority page is worth to you? Maybe I'm missing something here, because I can't imagine spam commenting being worth anything at any price. Let's just hope you didn't build anchor text into those comments.

17. Domain Purchase and Redirect/Canonical

Buying domains for their link juice is an old classic, but I don't think I have anything to add beyond what Danny Sullivan wrote on the matter. I'm also a fan of Rand's suggestion to buy blogs and run them rather than pulling out the fangs and sucking every ounce of life out of a once-thriving blog.
Domain buying still works disgustingly well in the (rare) cases where done correctly. I would imagine that dozens of redirected domains will eventually bring some unwelcome traffic to your site directly from Mountain View, but fighting spam has historically been much easier in my imagination than in reality.
This list is not meant to be comprehensive, but it should paint a picture of the types of spam that are out there, which ones are working, and what kinds of behaviors could get you in trouble.

Spam Links: Not Worth It

I have very deliberately written about what spam links "look like." If you do believe that black hat SEO is wrong, immoral, or in any way unsavory that's fine - just make sure your white hat links don't look like black hat links. If you think that white hat SEOs are sheep, or pawns of Google, the same still applies: your links shouldn't look manipulative.
I'm advising against the tactics above because the potential benefits don't outweigh the risks. If your questionable link building does fall apart and your links are devalued, there's a significant cost of time wasted building links that don't count. There's also the opportunity cost - what could you have been doing instead? Finally, clearing up a manual penalty can take insane amounts of effort and remove Google's revenue stream in the meantime.

{Source: seomoz}